I thought it happens at Layer 6, but some resources state that it happens at either Layer 3 or 4.

4 Answers 4


Encryption can happen at any of the levels of the OSI model. TLS happens at something like the session or transport level. Quantum Crytography isn't exactly encryption, but would be at the physical level. PGP in an email would be at the application level.

Remember that the OSI model is just one model, and largely represents an idea of separation of concerns and layering. TCP/IP doesn't map entirely to the OSI model, and encryption doesn't really fit within the model at all.

Speaking from a "separation of concerns" perspective, where you put encryption depends entirely on what you're trying to do. If you had to put encryption in a "place", you might say that it lives outside of the OSI model.


In my personal opinion, the layers are a bit fuzzy. In my mind there's physical, ethernet, IP, TCP, TLS, and finally some protocol like http. Or physical, ethernet, IP and finally ICMP, for example.

Which OSI layers those are exactly? Who cares.

TLS is called Transport Layer Security, but in my mind the transport layer is TCP/UDP. Googling, most people seem to put it on layer 6 indeed, but layer 5 is still hanging in between there with few concrete examples of what might run there.

Let's take another example: physical, Ethernet, IP, TCP, Tor, TLS, XMPP, PGP. That's 8 things, but we only have 7 layers to fit this in. Arguably XMPP and PGP both live in layer 7, so we can have multiple protocols per layer I guess? And Tor might be a fair example of layer 5 (examples for layer 5 include some things Tor does/has, like logical ports), but Tor does encryption just like TLS and PGP do in layers 6 and 7, respectively.

So layers are a fuzzy concept. If you're being asked this on a test, go for layer 6. Otherwise, why does it matter?


It depends on the protocol used. TLS is used for application level end-to-end encryption so it is somewhere at levels 5..7 (the distinction between these levels is blurry). Protocols like IPSec or OpenVPN instead work at the level of IP protocol, i.e. network layer which is layer 3. But there are also VPN technologies which do a VPN at the data link layer, i.e. layer 2.


It doesn't happen anywhere... because OSI doesn't actually happen anywhere.

OSI was always a theoretical model, and TCP/IP does not use OSI. Besides, arguing about "which layer" something happens at is pointless; it is much more important to understand how the layers interact, and what kind of protection would work best at each layer.

E.g you could get TLS on top of TCP; or IPsec on between TCP and IP; or WPA2 underneath IP. I am sure there are other options to consider too...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .